ECSA v10: EC-Council Certified Security Analyst v10

By ECCouncil · Question Mode

QuestionQ5

VerifiedNetwork Penetration Testing Methodology – External

While scanning a test network, Paul sends TCP probe packets with the ACK flag set to a remote device and analyzes the TTL and WINDOW header fields of the received RST packets to determine whether each port is open or closed.

Analyze the scan result below and identify the open port.

Question Image

Explanation

In the TTL-based ACK flag probe technique, an RST response with a TTL value below 64 indicates an open port. The response for port 20 has TTL 60, while the other listed ports have TTL values of 70 or higher. The TCP WINDOW values are all zero, so they do not distinguish the ports in this result.

Community Discussion

No comments yet. Be the first to start the discussion!